DevSecOps Security Engineer

We need to output HTML fragment with sections: About the role? Actually we need to use headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include only sections that have real specific content. We must not repeat job title as heading. Must not include Job ID etc. Must preserve all substantive info, no invented or summarizing away detail. Remove boilerplate like cookie/navigation/legal/EEO etc. Also remove application instructions. Also remove duplicated lines. We need to parse the description and extract relevant content. Let's identify sections: - About the role: description of role, mission, L-CAP, hybrid position, etc. Could be a paragraph. - Responsibilities: list of duties (What You'll Do bullet points). Those are many bullet points. - Requirements / Qualifications: Core Technical Qualifications (must have). Also Preferred/Desired Qualifications. - Skills: maybe combine technical skills? Could be part of qualifications. - Benefits: Pay and Benefits section mentions competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. Also mention Pay Range. - Pay: Pay Range $87,100.00 - $157,450.00. - Schedule: hybrid position requiring 3 days onsite and 2 days WFH, if within commutable distance; else 100% remote. We must not create sections with filler like "commensurate with experience". We have actual content. We must not repeat job title as heading. We must not include Job ID/requisition numbers. We must not include boilerplate like "Original Posting September 22, 2026", "For U.S. Positions: While subject to change..." etc. Also remove "Why Leidos?" maybe that's not a standard heading but could be considered "About Leidos"? But we have "About Leidos" section later. However we need to decide if we include "About Leidos" as a section? The instruction says use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but we should stick to those. However we can include "About Leidos" if we think it's substantive. But the instruction says "Prefer a few substantive sections over many thin ones." Might be okay to include About Leidos as a paragraph under About the role? Might be redundant. The "About Leidos" paragraph is generic company description; could be considered boilerplate? It's not exactly boilerplate but it's generic. Might be okay to include but maybe not needed. The instruction says remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "About Leidos" is not those; it's company overview. Could keep as a paragraph under About the role or separate section "About Leidos". But the allowed headings list didn't include About Leidos; but we could still include if we think it's substantive. However to be safe, we can incorporate that info into About the role section. We need to preserve all substantive information: details about L-CAP, hybrid work, AI-first, SAFe/Agile, Public Trust, etc. Must keep. We must not invent or summarize away detail: we must keep specifics like tools, certifications, etc. We need to use

for section headings. We need to use

• for any list of duties/requirements/benefits. We need to use

  for prose. We must output only HTML fragment, no /, no markdown. Let's craft. Structure:

  About the role

  Leidos is seeking a DevSecOps Security Engineer to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP). L-CAP is a mission‑critical, future‑ready automation platform built on a hybrid cloud data mesh architecture, enabling next‑generation air traffic management capabilities. The team builds with an AI‑first engineering mindset, embracing emerging AI capabilities and modern development practices to accelerate delivery, improve software quality, and continuously evolve how mission‑critical systems are designed and built. The role operates within a SAFe/Agile framework as part of an Agile Release Train (ART) delivering iterative value across the program. This position supports government programs and requires the ability to obtain and maintain a favorable Public Trust investigation. It is a hybrid position requiring 3 days onsite and 2 days working from home if you reside within a commutable distance (

  Responsibilities

  • Implement and maintain automated security controls in CI/CD pipelines, including SAST, DAST, software composition analysis, container scanning, and infrastructure‑as‑code scanning.
  • Enforce security gates, artifact signing, provenance verification, and SBOMs (CycloneDX/SPDX) to prevent vulnerable or unverified deployments.
  • Drive container vulnerability remediation and hardening, including hardened minimal base images and elimination of critical/high findings.
  • Implement Kubernetes security controls, including pod security, network policies, RBAC, admission controls, and security context constraints.
  • Secure workloads through secrets management, mutual TLS (mTLS), service mesh policies, and Linux/container hardening.
  • Build and maintain policy‑as‑code and infrastructure guardrails using OPA/Rego, Kyverno, or equivalent tools.
  • Produce security evidence supporting authorization and continuous monitoring requirements.
  • Partner with platform and application teams to triage vulnerabilities, remediate findings, and support security incident response and root cause analysis.
  • Leverage AI‑assisted development, automation, and modern engineering practices to improve security, code quality, productivity, and delivery speed.

  Requirements

  Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field with 4+ years of relevant experience (additional experience, education and training may be considered in lieu of degree).

  • Hands‑on experience integrating SAST, DAST, software composition analysis, and container scanning into CI/CD pipelines.
  • Experience securing Kubernetes and container environments, including pod security, network policies, RBAC, admission controls, and hardened/minimal base images.
  • Experience with vulnerability scanning and remediation, using tools such as Nessus, Trivy, Grype, or Qualys, including CVE triage and tracking.
  • Experience with secrets management (HashiCorp Vault or equivalent) and security automation using Python, Bash, or Go.
  • Experience with Git‑based workflows and CI/CD tooling, such as GitLab CI, GitHub Actions, or Jenkins.
  • Working knowledge of NIST 800‑53, automated security evidence, and AWS or Azure cloud security.
  • Understanding of network security, including segmentation and default‑deny policies.
  • U.S. citizenship required, with the ability to obtain and maintain a Public Trust and meet government background investigation requirements.
  • Must meet FAA facility and information system access requirements, including continuous U.S. residency for at least 3 of the prior 5 years.

  Preferred Qualifications

  • Security+ CE, CySA+, or equivalent DoD 8570 IAT Level II certification.
  • Certified Kubernetes Administrator (CKA) or Certified Kubernetes Security Specialist (CKS).
  • Knowledge of software supply chain security, including SLSA, Sigstore/cosign, in‑toto, and FIPS 140‑3.
  • Experience with policy‑as‑code (OPA/Rego, Kyverno) and infrastructure‑as‑code security scanning (Terraform, CloudFormation).
  • Experience securing Kubernetes/OpenShift environments, including service mesh security (Istio, Linkerd) and security context constraints.
  • Experience with GitOps deployment using ArgoCD, Flux, or equivalent.
  • Experience in aviation, FAA, or other safety‑critical environments.
  • Experience with SAFe or large‑scale Agile delivery.

  Benefits

  Leidos offers competitive compensation, Health and Wellness programs, Income Protection, Paid Leave, and Retirement benefits. More details are available at www.leidos.com/careers/pay-benefits.

  Pay

  Pay Range: $87,100.00 – $157,450.00 (Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary).

  Schedule

  Hybrid position: 3 days onsite and 2 days working from home if you reside within a commutable distance ( We must ensure we didn't include any boilerplate like "Original Posting September 22, 2026", "For U.S. Positions: While subject to change..." etc. We omitted those. Also omitted "Why Leidos?" and "ATMC" etc. Also omitted "Step 10 is ancient history." etc. Also omitted "Securing Your Data" etc. Also omitted "Commitment to Non-Discrimination". Good. Check for any duplicated lines: we didn't duplicate. Check for any invented detail: we didn't add anything not present. We paraphrased but kept substance. Must not summarize away detail: we kept specifics like tools, certifications, etc. Good. Check for any missing substantive info: The description also mentions "This role operates within a SAFe/Agile framework as part of an Agile Release Train (ART) delivering iterative value across the program." We included that in About the role. Also "This position supports government programs and requires the ability to obtain and maintain a favorable Public Trust investigation." Included. Also "U.S. citizenship required, with the ability to obtain and maintain a Public Trust and meet government background investigation requirements." Included. Also "Must meet FAA facility and information system access requirements, including continuous U.S. residency for at least 3 of the prior 5 years." Included. Also "Leverage AI-assisted development, automation, and modern engineering practices to improve security, code quality, productivity, and delivery speed." Included in responsibilities. Also "Build and operate the automated security controls embedded in L-CAP’s delivery pipeline — the scanning, gating, signing, and hardening that make security continuous rather than periodic." That's part of responsibilities but we have similar bullet. Also "You will work alongside platform and application teams to raise the security posture of every build and every container image without stalling delivery, and you will produce the pipeline evidence that supports platform security authorization." Covered. Also "Implement and maintain automated security controls in CI/CD pipelines, including SAST, DAST, software composition analysis, container scanning, and infrastructure-as-code scanning." Covered. Also "Enforce security gates, artifact signing, provenance verification, and SBOMs (CycloneDX/SPDX) to prevent vulnerable or unverified deployments." Covered. Also "Drive container vulnerability remediation and hardening, including hardened minimal base images and elimination of critical/high findings." Covered. Also "Implement Kubernetes security controls, including pod security, network policies, RBAC, admission